Threats, Vulnerabilities, and Attack Techniques
Threats, Vulnerabilities, and Attack Techniques tests how attacks work and how to describe them precisely. Expect questions on malware, social engineering, web vulnerabilities, threat modeling, and scoring.
Core rules
- A vulnerability is a weakness; an exploit is the code or action that abuses it; a threat is an actor or event that can cause harm. Risk combines all three with impact.
- Malware categories: virus (needs a host), worm (self-propagating), trojan (disguised), ransomware (encrypts/extorts), spyware (collects), rootkit (hides), botnet agent.
- Web vulnerabilities: SQL injection manipulates database queries; XSS executes script in a victim’s browser; CSRF tricks an authenticated browser into sending a request; IDOR exposes objects by weak authorization checks.
- Social engineering: phishing, spear phishing, vishing, pretexting, baiting. Supply-chain attacks compromise trusted software or vendors.
- MITRE ATT&CK describes adversary tactics and techniques; CVSS scores severity but not business risk.
Worked example
An email claims to be from a supplier, uses a lookalike domain, urges an urgent wire transfer, and attaches an HTML file. The message is phishing with a pretext of urgency; the attachment may harvest credentials when opened. Verify the sender domain and SPF/DKIM/DMARC results, contact the supplier through a known channel, and report the message. Do not forward the attachment to colleagues. The CVSS score of any linked vulnerability is irrelevant until you know the attachment’s behavior.
Traps
CVSS base score is not risk; environmental and business context matter. A vulnerability is not an exploit. XSS runs in the victim’s browser, not on the server. Phishing is not always malware. Do not call a port scan an exploit.